Thinking About Source Code Security in New Ways
summary
Gittuf is a client-side security layer for Git that embeds policy, keys and an append-only reference state log inside repo refs so every clone can verify history and detect tampering. It implements client-side verification of branch/tag/file rules, delegations and a minimum-signature model, using a custom transport that works with existing forges. Demo shows authorized pushes verify clean and an altered commit fails verification. Project is incubating at OSSF and already interoperates with common Git hosting.
AI-written summary · about
chapters (9)
- 0:00Source code security risks
- 3:13Git’s security limits
- 6:46GitTough and its goals
- 9:39GitTough policy system
- 13:33Thresholds and delegations
- 15:20Live demo of GitTough
- 20:43Handling unauthorized changes
- 21:47Compatibility and community
- 22:28Q&A
related talks
38mSecuring Git Repositories with Gittuf
29mIdentity-based Source Integrity with Gitsign
24mThe State of Git Security With SLSA and Gittuf
10mSource Attestations with Gitsign
37mGitsign – Keyless Git Commit Signing
35mAchieving End-To-End Software Supply Chain Security With in-toto
49mProtect Your Code with GitHub Security Features
36mHardening the Source: Scaling Branch Governance with Gemara, ComplyTime and Ampel